# SSO is forcibly creating the user as an admin
**URL:** https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386
**Category:** Bug
**Created:** [September 13, 2021, 12:29pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386 "2021-09-13T12:29:21Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 13, 2021, 12:29pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/1 "2021-09-13T12:29:21Z")
Hello
I am integrating [discourse SSO](https://meta.discourse.org/t/13045?silent=true), however I am facing a problem where the user being created is getting admin privileges even though that the SSO payload explicitly states that he shouldn’t be.
I am on the latest beta: 2.8.0.beta6 [f3273bd43e]
Here is a an example:
SSO URL:
[https://community.bloom.pm/session/sso\_login?sso=ZXh0ZXJuYWxfaWQ9NjEzZjJmMzMzNWZkODc4NWU4Mjk4Y2JhJm5vbmNlPThiNzdjM2JlMDBmMThkMjYwMDhkYjkxOWQxODA4MzAyJmVtYWlsPW9tYXIlMkJtZW1iZXI0JTQwYmxvb20ucG0mdXNlcm5hbWU9bWVtYmVyNCZuYW1lPW1lbWJlcjQmYWRtaW49ZmFsc2UmbW9kZXJhdG9yPWZhbHNlJnN1cHByZXNzX3dlbGNvbWVfbWVzc2FnZT10cnVl&sig=fcb3e5d3d4b8c39078753cb495f4c3781dcca1f022851a2bdff2015e7fa489b1](https://community.bloom.pm/session/sso_login?sso=ZXh0ZXJuYWxfaWQ9NjEzZjJmMzMzNWZkODc4NWU4Mjk4Y2JhJm5vbmNlPThiNzdjM2JlMDBmMThkMjYwMDhkYjkxOWQxODA4MzAyJmVtYWlsPW9tYXIlMkJtZW1iZXI0JTQwYmxvb20ucG0mdXNlcm5hbWU9bWVtYmVyNCZuYW1lPW1lbWJlcjQmYWRtaW49ZmFsc2UmbW9kZXJhdG9yPWZhbHNlJnN1cHByZXNzX3dlbGNvbWVfbWVzc2FnZT10cnVl&sig=fcb3e5d3d4b8c39078753cb495f4c3781dcca1f022851a2bdff2015e7fa489b1)
Decoding the sso payload gives:
external\_id=613f2f3335fd8785e8298cba&nonce=8b77c3be00f18d26008db919d1808302&email=omar%2Bmember4%40bloom.pm&username=member4&name=member4&admin=false&moderator=false&suppress\_welcome\_message=true
However member4 was created with admin privileges
---
### Author:  [@IAmGav](https://meta.discourse.org/u/IAmGav)
#### Post date: [September 13, 2021, 12:33pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/2 "2021-09-13T12:33:03Z")
is member4’s email address in the config file under developer ?
`DISCOURSE_DEVELOPER_EMAILS`
any email address listed there, will automatically become admin
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 13, 2021, 1:08pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/3 "2021-09-13T13:08:27Z")
> [@IAmGav](#):
>
> DISCOURSE\_DEVELOPER\_EMAILS
I justed with omar+member9@306.dev which is a totally different domain and not on `DISCOURSE_DEVELOPER_EMAILS` but the issue is still there, the user got admin access
The api key I am using to sign the SSO belongs to admin, does that affect anything ?
---
### Author:  [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [September 13, 2021, 8:30pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/4 "2021-09-13T20:30:33Z")
> [@ohm-s](#):
>
> The api key I am using to sign the SSO
That does not sound right? Can you explain what you are doing?
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 9:07am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/5 "2021-09-14T09:07:05Z")
I just integrated SSO on an existing discourse site and I am getting this behavior.
The site is running using docker (discourse\_docker repo)
I logged in to the container and access the postgres db, the user has admin flag as false in the db so it is not being updated by the “make\_developer\_admin” method
What else could be there ?
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 9:11am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/6 "2021-09-14T09:11:34Z")
I am also using those plugins
```plaintext
- git clone https:// github.com/discourse/docker_manager.git
- git clone https:// github.com/angusmcleod/discourse-events.git
- git clone https:// github.com/gdpelican/babble.git
- git clone https:// github.com/davidtaylorhq/discourse-whos-online.git
- git clone https:// github.com/discourse/discourse-checklist.git
- git clone https:// github.com/discourse/discourse-data-explorer.git
- git clone https:// github.com/BeXcellent/discourse-allowiframe.git
```
---
### Author:  [@IAmGav](https://meta.discourse.org/u/IAmGav)
#### Post date: [September 14, 2021, 9:35am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/7 "2021-09-14T09:35:05Z")
you might want to enable debugging to troubleshoot
### Debugging your [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider
To assist in debugging [DiscourseConnect](https://meta.discourse.org/t/13045) you may enable the site setting `verbose_discourse_connect_logging` . By enabling that site setting rich diagnostics will show up in `YOURSITE.com/logs` . Be sure to ✅ the `warnings` box at the bottom of `YOURSITE.com/logs` .
reference: [Setup DiscourseConnect - Official Single-Sign-On for Discourse (sso)](https://meta.discourse.org/t/discourseconnect-official-single-sign-on-for-discourse-sso/13045)
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 11:28am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/8 "2021-09-14T11:28:07Z")
The user is not admin, however there is a deeper issue, i added some logs
it looks like some kind of filtering bug using ActiveRecord api, i logged the queries and I don’t see userid in the where filter so it looks it is pulling the notifications data globally
Same thing i guess is happening with forums / topics, it is somehow ignoring the userid filter and getting everything
How can i fix this ?
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 11:28am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/9 "2021-09-14T11:28:39Z")
Posting 2nd media item (since i am new )
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 11:29am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/10 "2021-09-14T11:29:23Z")
Posting 3rd media item - logs
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 12:20pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/11 "2021-09-14T12:20:51Z")
It looks like `user.notifications` is not adding the filter , i have manually added a where condition in the code and it got fixed in the modal notifications display, but in the details page, it uses a different code path so it is still displaying everything. What’s the real solution ? 😑
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 14, 2021, 12:31pm UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/12 "2021-09-14T12:31:25Z")
rails version: 6.1.4.1
bundle exec gem list --local
\*\*\* LOCAL GEMS \*\*\*
actionmailer (6.1.4.1)
actionpack (6.1.4.1)
actionview (6.1.4.1)
actionview\_precompiler (0.2.3)
active\_model\_serializers (0.8.4)
activejob (6.1.4.1)
activemodel (6.1.4.1)
activerecord (6.1.4.1)
activesupport (6.1.4.1)
addressable (2.8.0)
aws-eventstream (1.2.0)
aws-partitions (1.432.0)
aws-sdk-core (3.112.1)
aws-sdk-kms (1.44.0)
aws-sdk-s3 (1.96.1)
aws-sdk-sns (1.38.0)
aws-sigv4 (1.2.3)
barber (0.12.2)
bootsnap (1.8.1)
builder (3.2.4)
bundler (2.2.26)
byebug (11.1.3)
cbor (0.5.9.6)
chunky\_png (1.4.0)
coderay (1.1.3)
colored2 (3.1.2)
concurrent-ruby (1.1.9)
connection\_pool (2.2.5)
cose (1.2.0)
cppjieba\_rb (0.3.3)
crass (1.0.6)
css\_parser (1.10.0)
diffy (3.4.0)
discourse-ember-rails (0.18.6)
discourse-ember-source (3.12.2.3)
discourse-fonts (0.0.9)
ecma-re-validator (0.3.0)
email\_reply\_trimmer (0.1.13)
ember-data-source (3.0.2)
ember-handlebars-template (0.8.0)
ember-source (2.18.2)
erubi (1.10.0)
excon (0.85.0)
execjs (2.8.1)
exifr (1.3.9)
faraday (1.7.2)
faraday-em\_http (1.0.0)
faraday-em\_synchrony (1.0.0)
faraday-excon (1.1.0)
faraday-httpclient (1.0.1)
faraday-net\_http (1.0.1)
faraday-net\_http\_persistent (1.2.0)
faraday-patron (1.0.0)
faraday-rack (1.0.0)
fast\_blank (1.0.1)
fast\_xs (0.8.0)
fastimage (2.2.5)
ffi (1.15.4)
fspath (3.1.2)
gc\_tracer (1.5.1)
globalid (0.5.2)
guess\_html\_encoding (0.0.11)
hana (1.3.7)
hashie (4.1.0)
highline (2.0.3)
hkdf (0.3.0)
htmlentities (4.3.4)
http\_accept\_language (2.1.1)
i18n (1.8.10)
image\_optim (0.30.0)
image\_size (2.1.2)
in\_threads (1.5.4)
jmespath (1.4.0)
jquery-rails (4.4.0)
json (2.5.1)
json\_schemer (0.2.18)
jwt (2.2.3)
kgio (2.11.4)
libv8-node (15.14.0.1 x86\_64-linux)
lograge (0.11.2)
logstash-event (1.2.02)
logstash-logger (0.26.1)
logster (2.9.7)
loofah (2.12.0)
lru\_redux (1.1.0)
lz4-ruby (0.3.3)
mail (2.8.0.edge)
maxminddb (0.1.22)
memory\_profiler (1.0.0)
message\_bus (3.3.6)
method\_source (1.0.0)
mini\_mime (1.1.1)
mini\_racer (0.4.0)
mini\_scheduler (0.13.0)
mini\_sql (1.1.3)
mini\_suffix (0.3.2)
minitest (5.14.4)
msgpack (1.4.2)
multi\_json (1.15.0)
multi\_xml (0.6.0)
multipart-post (2.1.1)
mustache (1.1.1)
nio4r (2.5.8)
nokogiri (1.12.4 x86\_64-linux)
oauth (0.5.6)
oauth2 (1.4.7)
oj (3.13.2)
omniauth (1.9.1)
omniauth-facebook (8.0.0)
omniauth-github (1.4.0)
omniauth-google-oauth2 (0.8.2)
omniauth-oauth (1.2.0)
omniauth-oauth2 (1.7.1)
omniauth-twitter (1.4.0)
openssl (2.2.0)
openssl-signature\_algorithm (1.1.1)
optimist (3.0.1)
pg (1.2.3)
progress (3.6.0)
pry (0.13.1)
pry-byebug (3.9.0)
pry-rails (0.3.9)
public\_suffix (4.0.6)
puma (5.4.0)
r2 (0.2.7)
racc (1.5.2)
rack (2.2.3)
rack-mini-profiler (2.3.3)
rack-protection (2.1.0)
rack-test (1.1.0)
rails-dom-testing (2.0.3)
rails-html-sanitizer (1.4.2)
rails\_failover (0.7.3)
rails\_multisite (3.1.0)
railties (6.1.4.1)
raindrops (0.19.2)
rake (13.0.6)
rbtrace (0.4.14)
rchardet (1.8.0)
redis (4.4.0)
redis-namespace (1.8.1)
regexp\_parser (2.1.1)
request\_store (1.5.0)
rinku (2.0.6)
rotp (6.2.0)
rqrcode (2.1.0)
rqrcode\_core (1.2.0)
rtlit (0.0.5)
ruby-readability (0.7.0)
ruby2\_keywords (0.0.5)
rubyzip (2.3.2)
sanitize (6.0.0)
sassc (2.0.1)
sassc-rails (2.1.2)
seed-fu (2.3.9)
sidekiq (6.2.2)
sprockets (3.7.2)
sprockets-rails (3.2.2)
sshkey (2.0.0)
stackprof (0.2.17)
thor (1.1.0)
tilt (2.0.10)
tzinfo (2.0.4)
uglifier (4.2.0)
unf (0.1.4)
unf\_ext (0.0.7.7)
unicorn (6.0.0)
uri\_template (0.7.0)
webpush (1.1.0)
xorcist (1.1.2)
zeitwerk (2.4.2)
---
### Author:  [@ohm-s](https://meta.discourse.org/u/ohm-s)
#### Post date: [September 16, 2021, 11:11am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/13 "2021-09-16T11:11:02Z")
I started a new docker container from scratch and moved the assets/data, that fixed the issue
Rebuilding the existing container did not help
#closed
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 17, 2021, 12:01am UTC](https://meta.discourse.org/t/sso-is-forcibly-creating-the-user-as-an-admin/203386/14 "2021-09-17T00:01:28Z")